Essential information

Value / Name

1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75

Confidence

100/100

Revoked

No

Valid from

05/09/2025 12:46

Valid until

01/09/2026 20:40

Pattern type

stix

Published

20/12/2025 19:59

Modified

21/12/2025 19:43

Author / Source

AlienVault

Description

No description.

Pattern

[file:hashes.'SHA-256' = '1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75']

Labels / Tags

Labels: booking.com botnet c2 communication castlebot castleloader castlerat clickfix keylogging logistics lumma stealer malware-as-a-service matanbuchus netsupport rat nightshadec2 phishing sandbox evasion sectoprat trojanized software uac bypass warmcookie

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.